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Abstract. We propose two Quantum Direct Communication (QDC) 
protocols with user authentication. Users can identify each other by 
checking the correlation of Greenberger-Horne-Zeilinger (GHZ) states. 
Alice can directly send a secret message to Bob using the remaining GHZ 
states after authentication. Our second QDC protocol can be used even 
though there is no quantum link between Alice and Bob. The security of 
the transmitted message is guaranteed by properties of entanglement of 
GHZ states. 
PACS : 03.67.Dd 



1 Introduction 

Quantum Cryptography utilizes the original characteristics of quantum mechan- 
ics such as superposition, entanglement and so on. Using these properties, some 
information can be secretly shared between users through a quantum channel. 
The information can be a key or a message. Quantum Key Distribution (QKD) 
protocols are used to share a key and Quantum Direct Communication (QDC) 
protocols are employed to send a message. 

Many QKD protocols have been proposed since Bennett and Brassard first 
proposed a quantum key distribution protocol[l] in 1984. The security of some 
QKD protocols was theoretically proven in [2-4]. On the other hand, QDC starts 
to be researched nowadays. First QDC protocol was proposed by Beige et al. [5] 
in 2002. It was followed by other QDC protocols [6-10]. 

In most QDC protocols except two protocols proposed by Beige et al. [5] and 
Deng et al. [6], the receiver(Bob) must begin the protocol to get a secret message 
from the sender( Alice). For example Bob should generate single photons[7,8] or 
Bell states[9] or qutrit states[10] and transmit all or some part of them to Alice. 
In addition, most QDC protocols are vulnerable to the man in the middle attack. 

We propose two QDC protocols, which combine user authentication and di- 
rect communication in quantum world at first time. To authenticate users, an 
authentication method proposed in [11] is introduced. After authentication Alice 
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can send a secret message directly to Bob. This message may not be leaked to a 
third party. Moreover Alice and Bob can communicate without a quantum link 
between them in our second QDC protocol. We present our QDC protocols in the 
chapter 2, then analyze the security of them in chapter 3 and make conclusions 
in chapter 4. 

2 Quantum Direct Communication Protocols 

Our quantum direct communication protocols are composed of two parts: one is 
an authentication and the other a direct communication. The third party Trent 
is introduced to authenticate the users participating in the communication. He is 
assumed to be more powerful than other users and he supplies the Greenberger- 
Horne -Zeilinger (GHZ) states[12]. 

2.1 Authentication 

User's secret identity sequence and a one-way hash function are known to Trent. 
This information must be kept secret between the user and the arbitrator. Sup- 
pose Alice's(Bob's) identity sequence and her(his) one-way hash function are 
IDa(IDb) and Ha^b), respectively. For examplc, a one-way hash function is 
h : {0,1}* x {0, 1} C — ► {0,1}', where * is arbitrary length, c the length of a 
counter and / a fixed number. Alice's(Bob's) authentication key shared with 
Trent can be calculated as }ia{IDa, ca)(/ïb(-Í-D b, Cb)), where ca{cb) is the 
counter of calls on Alice's(Bob's) hash functions. Authentication keys are used 
to determine unitary operations on GHZ partides heading from the arbitrator 
to the owner. Users can authenticate each other by checking the correlation of 
the GHZ states taken the reverse unitary operations. 

If Alice wants to send a secret message to Bob, she notifies this fact to Bob 
and Trent. On rcceiving the request, Trent generates TV GHZ tripartite states 
1^) = I V'l) •••IV' n)- For simplicity the following GHZ state \ipi) is supposed to be 
preparcd. 

= -^=(|000)atb + |111>atb) 

where the subscripts A, T and B correspond to Alice, Trent, and Bob, respec- 
tively. In this paper, we represent the z basis as {|0),|1)} and the x basis as 
{|+>, |-)}, where |+) = -*-(|0) + |1» and R = -^(|0) - |1». 

Next, Trent encodes Alice's and Bob's partides of GHZ states with their 
authentication keys, }ia(IDa, ca) and }ib{IDb-, cb), respectively. For example, if 
the ith value of HaÍIDa, c^Xor }ib{IDb-, Cb)) is 0, then Trent makes an identity 
operation / to Alice's (Bob's) particle of the ith GHZ state. If it is 1, Hadamard 
operation H is applicd. If the authentication key HaÍIDa, ca) (or }ib(IDb, cb)) 
does not have enough length to cover all GHZ partides, new authentication keys 
can be created by increasing the counter until the authentication keys shield all 
GHZ partides. After making operations on the GHZ partides, Trent distributes 
the states to Alice and Bob and keeps the remaining for him. 
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Fig. 1. Procedures of Authentication 0. Alice and Bob register their secret 
identity and hash functions to Trent, respectively. 1. Trent generates GHZ states 
\ip) = -^=(|000) atb + |111)atb)- 2. Trent makes unitary operations on \if)} with Alice's 
and Bob's authentication key. 3. Trent distributes GHZ partides to Alice and Bob. 4. 
Alice and Bob make reverse unitary operations on their qubit with their authentication 
key, respectively. 5. Alice and Bob choose the position of a subset of GHZ states and 
make a local measurement in the z basis on them and compare the results. 



On receiving the qubits, Alice and Bob decode the qubits with unitary trans- 
formations which are defined by their authentication keys, Ha{IDa, ca) and 
IibÍIDe, cb), respectively. Next, Alice and Bob select some of the decoded 
qubits, make von-Neumann measurements on them, and compare the results 
through the públic channel. If the error rate is higher than expected, then Alice 
and Bob abort the protocol. Otherwise they can confirm that the other party is 
legitimate and the channel is secure. They then execute the following message 
transmission procedures. 

2.2 Direct Communication Protocol 1 

Alice selects a subset of GHZ states in the remaining sets after authentication 
and keeps it secret. Alice chooses a random sequence which has no connection 
with the secret message to transmit to Bob. Following this random sequence, 
Alice performs unitary transformations on the qubits selected for this chcck 
process. Before encoding the message and the random sequence, Alice can encode 
the secret message with a classical Error Correction Code (ECC) such as the 
Hamming Code, the Reed-Solomon code and the BCH code, so that Bob could 
be able to correct errors in the decoded message. For example, if the error rate of 
the quantum channel is 20% and the length of codeword is n, then any classical 
ECCs can be used, where the minimum length of the code d is larger than 
LirJ + 1- tnc bit of the random sequence, or the message is 0, then Alice 
performs on her GHZ particle with Hadamard operation H. Otherwise, Alice 
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acts at her qubit with first Bit flip operation X and then Hadamard operation 
H. After making all unitary operations, Alice transfers all encoded qubits to 
Bob. 



Trent 




Alice Bob 



Fig. 2. Procedures of the first Direct Communication protocol 1. Alice chooses 
a subset of GHZ states and a random sequence. Alice performs unitary transformation 
both on the qubits selected for this check process following this random sequence and 
on the remaining qubits following the secret message. For example if the bit is 0, 
she makes a Hadamard operation H, otherwise a bit flip operation and a Hadamard 
operation HX. 2. Alice sends the qubits to Bob. 3. Bob makes Bell measurements 
on pairs of partides consisting of his qubits and Alice's qubit. 4. Trent makes von 
Neumann measurements on his GHZ partides and reveals the results. 5. Alice and Bob 
compare the check bits. 



Bob makes Bell measurements on pairs of partides consisting of his qubit 
and Alice's qubit. In this paper we use the following notations of Bell states. 

|#+) = -±={|00) + |11» 

l*-> = ^{|oo>-|ii» 

|^+) = -L{|01) + |10)} 

hn = ^{|oi>-|io>} 

Trent measures his third qubit in the x basis and publishes the measure- 
ment outcomes. Bob recovers Alice's message using the table [1]. For example, 
if Bob measures |^ + ) and Trent reveals |+), then Bob can infer Alice made HX 
operation and she sent 1. 
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Table 1. Operations on the decrypted GHZ state(i.e. \rp)) and Transformation of the 
GHZ state 



Alice's 
Operation 


Transformation of GHZ states 
after Alice's operation 


H(0) 


\{\$ + )ab\-)t + \®~)ab\+)t + \>P + )ab\+)t - \&~)ab\-)t) 


HX(1) 


ï{\$ + )ab\+)t + \$-}ab\-)t - W + )ab\-)t + \V-)ab\+)t) 



After obtaining all messages, Bob notifies this fact to Alice. Alice reveals the 
position of the check bits and compares the bits with Bob. If the error rate is 
higher than expected, Alice and Bob conclude there was an eavesdropper. The 
message contains errors, but fortunately Eve cannot know its content. Othcrwise 
Bob can extract the secret message from the remaining bits. 

2.3 Direct Communication Protocol 2 

The second QDC protocol is same as the first protocol except Alice sends her 
encoded qubits to the Trent. However it is not needed additional quantum link 
between Alice and Bob in this protocol. After making Bell measurement on his 
and Alice's qubits, Trent reveals the result. If |<£ + ) or | ) , then Trent publishes 
0. Otherwise he notifies 1. Bob measures his partides on the X basis. (This 
process of Bob can be preceded even before the Alice's operation.) Using the 
Trent's publication and his measurement, Bob can infer which operations were 
used by Alice as shown in the table [2]. If is publishcd and |+) is measured, 
Bob can discover Alice operated HX (1). 

Table 2. Operations on the decrypted GHZ state(i.e. \tp)) and Transformation of the 
GHZ state 



Alice's 
Operation 


Transformation of GHZ states 
after Alice's operation 


H(0) 


Í(\$ + }at\-}b + \<P-)at\+)b + \V + )at\+)b - \¥-)at\-)b) 


HX(1) 


Í(\$ + }at\+)b + \$-)at\-)b - \* + )at\-)b + \¥-)at\+)b) 



Alice reveals the position of her check bits and compares them with Bob. If 
the error rate of the check bits is higher than expected, Bob throws away the 
message. Otherwise, Bob can get the whole secret by applying the classical ECC 
code used by Alice if it was used. 

3 Security Analysis 

The security of our protocol results from the properties of the entanglement of 
GHZ states. We hrst analyze the process of authentication. If Trent is honest, 
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Fig. 3. Procedures of the second Direct Communication protocol 1. Alice 
chooses the position of check bits and a random sequence. Alice performs unitary 
transformation on the qubits selected for this check process following this random 
sequence and on the remaining qubits following the secret message. For example if 
the bit is 0, she makes a Hadamard operation H, otherwise a bit flip operation and a 
Hadamard operation HX. 2. Alice sends the encoded qubits to Trent. 3. Trent makes 
Bell measurements on pairs of partides consisting of his qubits and Alice's qubit. 4. 
Trent reveals the measurement outcomes. 5. Bob makes von Neumann measurements 
on his GHZ partides. 6. Alice and Bob compare the check bits. 



tlien he will gcncratc tripartite GHZ states, encrypt them with the right au- 
thentication keys and then distribute them to the designated users. Only the 
designated user can decrypt the qubits to recover the original GHZ states. This 
procedure can be written in the following form of a sequence of local unitary 
operation, the initial state: 

= -^(|000)atb + |1H)ats) 
v2 

state after Trent's transformation 

|V>i>2 = {[1- f A (ID A ,c A )]I +[f A (ID A ,c A )]H} A 

® {[1 - f B (ID B ,c B )]I + [f B {ID B , c B )]H} B \il>i)x 
and finally the state after Alice's and Bob's local opcrations 

\1>ih = {[1- f A (ID A ,c A )]I+[f A (ID A c A )]H} A 

® {[1 - f B (W B ,c B )}I + [f B (ID B , c b )}H} b \iPí) 2 
= \ipi)i 

where \ipi) is the state of the i-th GHZ particle and the subscript 1, 2, and 
3 represents the three steps of authentication. Of course, such is the situation 
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if there is no Eve. Suppose Eve intercepts the qubits heading to Alice or Bob 
and disguises her or him. Eve can be detected with probability 1/4 per chcck 
bits in this authentication process since she does not know Alice's or Bob's 
authentication key. 

Let an attacker, Eve, use a coherent attack. She then causes errors per check 
bit with a probability 1 /4 similarly to BB84 protocol if she uses the original bases 
used by Alice and Bob. It is because Eve didn't know the authentication key and 
she cannot decrypt the encoded qubits. For examplc, if the authentication key 
bit is 0, Eve doesn't make error in the qubit. Otherwise, an error occurs with 
probability 1/2. If Eve prepares |0) state and entangles with Alice's qubit, then 
the final state of the protocol qubit and Eve's qubit is after decoding by Alice 
and Bob as follows. 

W)atbe = UaeW)atb ® \0)e 
= |{|000) atb\+)e + |100) ATB |->b + \0U) atb\-)e + \111)atb\+)e} 

This is for aspecific attack where Uae\0)a\0)e — » |0)a|0)b and í/ab|1)a|0) e - 
11)^411} £7. Eve can be detected with higher probability 1/2 per check bit in this 
case. Hence, if m(<s; N) GHZ states are checked in the authentication process, 
Alice and Bob can confirm that the GHZ states are distributed to the legiti- 
mate users with probability 1 — (|) m . We expect more advanced attack can be 
detected when m is increased. 

After authentication process, only Alice's qubits are transmitted. Eve will 
make operations on these qubits in our quantum direct communication protocols. 
In both protocols, Eve must not be disclosed during the authentication process to 
obtain any information of secret message. Suppose Eve use the following unitary 
operation Uae on Alice's and her qubit \E). 

Uae\0E)ae = a\0) A \e ao )E + f3\l)A\eoi) E 

Uae\IE)ae = í3'\0) A \eio) E + a'\l) A \eu) E 

where \a\ 2 + \(3\ 2 = 1, \a'\ 2 + \(3'\ 2 = 1 and a(3* + a'* (3 1 = 0. 
Then the state of the protocol is changed as follows. 

1 The states after Alice made a unitary operation 

\Í>i)atbe = U a \^)atb ® \E) E 

= í(|000)atb T \W0) atb + \0ÍÍ)atb ± \U1) AT b) ® \E) E 

2 The states after Eve made a unitary operation on her qubit and Alice's qubit 
heading to Bob or Trent 

\lp2)ATBE — Uae\iPi) ATBE 

= i{|000)ATB(a|e 00 )±/3'| eio )) B + |100) J 4Ts(/3|eoi)±a'| eil )) E 

+ |011) A TB(a|e o) T P'\eio)) E + |lll)ATs(/?|e i) T a'|en)) £ } 



i 

2V2 



4 ) AB{\+)T(a\e o) ± P'\e w ) + (3\e 01 ) T a'\e n )) E 

+ |->r(a|eoo> ± P'\e w ) - P\e i) ± «'|en)) £ } 
+ ^As{l+)T(a|eoo) ± F\e w ) - (3\e 01 ) ± a'|eii)) B 
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+ |->r(a|eoo> ± P\e w ) + P\e i) T a'Ieii))^} 
(a|e 00 ) T I3'\e w ) + P\e i) ± a'|en)) E 

- \-)T(a\e 00 ) =f /3'|eio) - /3|e i) T a'|en)) E | 
+ ^As{l+)T(a|eoo} T /?'|e 10 ) - /3|e i) T a'|en)) B 

- |->r(a|eoo> T /3'|e 10 ) + /3|e i> ± o^n)^} 

As shown in the above equations, Eve will introduce errors in the check bits 
with the probability of 1 /2 regardless of the order of measurement by Bob, Trent 
and Eve. Moreover, Eve cannot get any information from this attack since Eve 
cannot distinguish the two cases which Alice made operation H or HX. For 
example, suppose Alice makes operation H(0), Bob measures |^ + ), and Eve 
measures |eoo). Then Trent will reveal |+) or |— ) with equal probability. If Trent 
reveals |+) then Bob can revoke correct information. Otherwise Bob can find an 
error. Hence if the length of the check sequence is long enough, then we can find 
the existence of Eve in the transmission of mcssage and confirm Eve does not 
intercept the message. 

4 Conclusions 

We have proposed two Authenticated Quantum Direct Communication proto- 
cols. Aftcr idcntifying the other user in the communication channcl, Alice can 
dircctly send a secret message to Bob without a previously shared secret key. 
According to the existence of a quantum link between Alice and Bob, they 
can choose a QDC protocol between two. If there exists eavesdropping during 
transmission, the message will be broken and Alice and Bob can ascertain the 
existence of Eve by the check-bits. Though the message was broken, Eve cannot 
get any information of the secret message. We expect our schemes can be applied 
well to quantum networks even in a transition period. 
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